Analysis
-
max time kernel
144s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
10/11/2024, 03:41
Static task
static1
Behavioral task
behavioral1
Sample
12e250865df87d8384eb7d0560fc78f5e7be56f8961ab9a55651dcb53029cf41.exe
Resource
win10v2004-20241007-en
General
-
Target
12e250865df87d8384eb7d0560fc78f5e7be56f8961ab9a55651dcb53029cf41.exe
-
Size
677KB
-
MD5
4d9974f47ed7f89af7bd15f4e009d310
-
SHA1
588174110854f4eccedbfbbcb9db1f3438ba7dd3
-
SHA256
12e250865df87d8384eb7d0560fc78f5e7be56f8961ab9a55651dcb53029cf41
-
SHA512
c2986dcb14d00e1ccc959d0eb66d0d88ec4bbce952020a98d03aa07b33717abdea84b91c3f5a0659588572625e653a2a00de4f04f35cfd5259e540de670e0a43
-
SSDEEP
12288:vMr6y90da0esz695ncl+Qo5kI00ZVzoAvusuXI42EzElcTJ6/9:1y9p8695ncl+BkPMEw7d42rOTS
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Signatures
-
Detects Healer an antivirus disabler dropper 17 IoCs
resource yara_rule behavioral1/memory/4804-19-0x0000000002370000-0x000000000238A000-memory.dmp healer behavioral1/memory/4804-21-0x0000000002480000-0x0000000002498000-memory.dmp healer behavioral1/memory/4804-22-0x0000000002480000-0x0000000002492000-memory.dmp healer behavioral1/memory/4804-49-0x0000000002480000-0x0000000002492000-memory.dmp healer behavioral1/memory/4804-47-0x0000000002480000-0x0000000002492000-memory.dmp healer behavioral1/memory/4804-45-0x0000000002480000-0x0000000002492000-memory.dmp healer behavioral1/memory/4804-44-0x0000000002480000-0x0000000002492000-memory.dmp healer behavioral1/memory/4804-41-0x0000000002480000-0x0000000002492000-memory.dmp healer behavioral1/memory/4804-39-0x0000000002480000-0x0000000002492000-memory.dmp healer behavioral1/memory/4804-37-0x0000000002480000-0x0000000002492000-memory.dmp healer behavioral1/memory/4804-35-0x0000000002480000-0x0000000002492000-memory.dmp healer behavioral1/memory/4804-33-0x0000000002480000-0x0000000002492000-memory.dmp healer behavioral1/memory/4804-31-0x0000000002480000-0x0000000002492000-memory.dmp healer behavioral1/memory/4804-29-0x0000000002480000-0x0000000002492000-memory.dmp healer behavioral1/memory/4804-27-0x0000000002480000-0x0000000002492000-memory.dmp healer behavioral1/memory/4804-25-0x0000000002480000-0x0000000002492000-memory.dmp healer behavioral1/memory/4804-23-0x0000000002480000-0x0000000002492000-memory.dmp healer -
Healer family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro8652.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro8652.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro8652.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro8652.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro8652.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pro8652.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 20 IoCs
resource yara_rule behavioral1/memory/4636-61-0x0000000006830000-0x0000000006876000-memory.dmp family_redline behavioral1/memory/4636-62-0x00000000068F0000-0x0000000006934000-memory.dmp family_redline behavioral1/memory/4636-66-0x00000000068F0000-0x000000000692F000-memory.dmp family_redline behavioral1/memory/4636-64-0x00000000068F0000-0x000000000692F000-memory.dmp family_redline behavioral1/memory/4636-63-0x00000000068F0000-0x000000000692F000-memory.dmp family_redline behavioral1/memory/4636-84-0x00000000068F0000-0x000000000692F000-memory.dmp family_redline behavioral1/memory/4636-96-0x00000000068F0000-0x000000000692F000-memory.dmp family_redline behavioral1/memory/4636-94-0x00000000068F0000-0x000000000692F000-memory.dmp family_redline behavioral1/memory/4636-93-0x00000000068F0000-0x000000000692F000-memory.dmp family_redline behavioral1/memory/4636-88-0x00000000068F0000-0x000000000692F000-memory.dmp family_redline behavioral1/memory/4636-86-0x00000000068F0000-0x000000000692F000-memory.dmp family_redline behavioral1/memory/4636-82-0x00000000068F0000-0x000000000692F000-memory.dmp family_redline behavioral1/memory/4636-80-0x00000000068F0000-0x000000000692F000-memory.dmp family_redline behavioral1/memory/4636-78-0x00000000068F0000-0x000000000692F000-memory.dmp family_redline behavioral1/memory/4636-76-0x00000000068F0000-0x000000000692F000-memory.dmp family_redline behavioral1/memory/4636-74-0x00000000068F0000-0x000000000692F000-memory.dmp family_redline behavioral1/memory/4636-72-0x00000000068F0000-0x000000000692F000-memory.dmp family_redline behavioral1/memory/4636-70-0x00000000068F0000-0x000000000692F000-memory.dmp family_redline behavioral1/memory/4636-68-0x00000000068F0000-0x000000000692F000-memory.dmp family_redline behavioral1/memory/4636-90-0x00000000068F0000-0x000000000692F000-memory.dmp family_redline -
Redline family
-
Executes dropped EXE 3 IoCs
pid Process 1756 un487330.exe 4804 pro8652.exe 4636 qu4124.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro8652.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro8652.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un487330.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 12e250865df87d8384eb7d0560fc78f5e7be56f8961ab9a55651dcb53029cf41.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 912 4804 WerFault.exe 84 -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 12e250865df87d8384eb7d0560fc78f5e7be56f8961ab9a55651dcb53029cf41.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language un487330.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pro8652.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language qu4124.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4804 pro8652.exe 4804 pro8652.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4804 pro8652.exe Token: SeDebugPrivilege 4636 qu4124.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 3020 wrote to memory of 1756 3020 12e250865df87d8384eb7d0560fc78f5e7be56f8961ab9a55651dcb53029cf41.exe 83 PID 3020 wrote to memory of 1756 3020 12e250865df87d8384eb7d0560fc78f5e7be56f8961ab9a55651dcb53029cf41.exe 83 PID 3020 wrote to memory of 1756 3020 12e250865df87d8384eb7d0560fc78f5e7be56f8961ab9a55651dcb53029cf41.exe 83 PID 1756 wrote to memory of 4804 1756 un487330.exe 84 PID 1756 wrote to memory of 4804 1756 un487330.exe 84 PID 1756 wrote to memory of 4804 1756 un487330.exe 84 PID 1756 wrote to memory of 4636 1756 un487330.exe 97 PID 1756 wrote to memory of 4636 1756 un487330.exe 97 PID 1756 wrote to memory of 4636 1756 un487330.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\12e250865df87d8384eb7d0560fc78f5e7be56f8961ab9a55651dcb53029cf41.exe"C:\Users\Admin\AppData\Local\Temp\12e250865df87d8384eb7d0560fc78f5e7be56f8961ab9a55651dcb53029cf41.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un487330.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un487330.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro8652.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro8652.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4804 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4804 -s 10044⤵
- Program crash
PID:912
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu4124.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu4124.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4636
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4804 -ip 48041⤵PID:3668
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
536KB
MD51722a5c5b761a6dbb5e5824b73d2a8e5
SHA1101d07ee7a24a5b731653b08ef484f681111ee9e
SHA256cbda069b967c85b08ee14caa2eb46a30fe88d4ddfbb808a681c667b6eb52bd40
SHA512386f7b4ac3a53e98a21e275cff1aeeeaed4ca03f7f9d974e45d8febd46d8e7c19a69174abae4301fbf083778de5988688f9bc1cba8acc3b57529c355a1cf02c8
-
Filesize
376KB
MD5848c1ac125af179c81c33499e9552c42
SHA1a437e924e8e7f72e59cc0f237e76d98440f82838
SHA2560073b53966a9eddf8022b71ff09c1914c44b8290bef3a320f9437c8d450de8af
SHA512ea20e535f2d4d8bf86dea7eaa5087c0866910738b4d9b78ac08c11e8388a5c1a99b769a2e5023ce4360b3a533b596035e1869f630802ccadd50daa73313de179
-
Filesize
435KB
MD5ab21f2aaf74d318b5ff72faeb4e6ff8c
SHA1d4b72c0f4943757a82bc2ab26a565b4dc49acc14
SHA256cf7ea25915bf3d93d705eb107677b6f1c4a968ec0ecde748bfe4c849eb3a1ad0
SHA512bf8084616162f5dd389b251a4717a6444c8fad1dc3dded8f754adc0f056cd08296551a1bb23ec07b0b08a27a03ffddfd3adeb23fd7d142a3c6e14c70ec3cfdeb